unblock send gate on stale payjoin session cleanup failure

Author: Sandipmandal25

rust/src/manager/wallet_manager/actor/transactions.rs

@@ -443,10 +443,39 @@ impl WalletActor {
             Ok(None) => {}
 
             Ok(Some(_)) => {
-                return Produces::ok(Err(Error::SignAndBroadcastError(
-                    "a previous payjoin session is pending recovery; please try again later"
-                        .to_string(),
-                )));
+                // If the session has a terminal marker and the tx is already in the local
+                // wallet, the only remaining work is session cleanup — no network needed.
+                // Attempt it here so this send can proceed without requiring a restart.
+                let persister = PayjoinSessionPersister::new(self.db.clone());
+                let can_cleanup = persister
+                    .pending_txid()
+                    .is_some_and(|txid| self.wallet.bdk.get_tx(txid).is_some());
+
+                if !can_cleanup {
+                    return Produces::ok(Err(Error::SignAndBroadcastError(
+                        "a previous payjoin session is pending recovery; please try again later"
+                            .to_string(),
+                    )));
+                }
+
+                // Retry persistence before cleanup — a prior broadcast may have applied the tx
+                // in memory without flushing to disk; only drop the session once it is durable.
+                if let Err(error) = self.wallet.persist() {
+                    warn!("failed to persist wallet at send gate before payjoin cleanup: {error}");
+                    return Produces::ok(Err(Error::SignAndBroadcastError(
+                        "a previous payjoin session is pending cleanup; please try again later"
+                            .to_string(),
+                    )));
+                }
+
+                if let Err(error) = self.db.delete_payjoin_sender_session() {
+                    warn!("payjoin session cleanup at send gate failed: {error}");
+                    return Produces::ok(Err(Error::SignAndBroadcastError(
+                        "a previous payjoin session is pending cleanup; please try again later"
+                            .to_string(),
+                    )));
+                }
+                // record cleared — fall through to allow this send
             }
 
             Err(error) => {
@@ -713,9 +742,13 @@ impl WalletActor {
             return;
         }
 
-        if let Err(error) = self.db.delete_payjoin_sender_session() {
-            warn!("failed to clear payjoin session record: {error}");
-        }
+        let session_cleared = match self.db.delete_payjoin_sender_session() {
+            Ok(()) => true,
+            Err(error) => {
+                warn!("failed to clear payjoin session record: {error}");
+                false
+            }
+        };
 
         let balance = self.wallet.balance();
         self.send(Msg::WalletBalanceChanged(balance.into()));
@@ -724,7 +757,17 @@ impl WalletActor {
         self.send(Msg::UpdatedTransactions(transactions));
 
         send!(self.addr.start_transaction_watcher(txid));
-        self.send(Msg::PayjoinTxBroadcast);
+
+        if session_cleared {
+            self.send(Msg::PayjoinTxBroadcast);
+        } else {
+            // TX is broadcast and wallet-persisted, but the session record remains.
+            // initiate_payment will reject new sends until the record is gone.
+            // The next startup will clear it automatically via the wallet pre-check.
+            self.send(Msg::SendFlowError(SendFlowErrorAlert::SignAndBroadcast(
+                "transaction was broadcast; restart the app to unlock sending".to_string(),
+            )));
+        }
     }
 
     /// Broadcasts `tx` and calls `finalize_payjoin_terminal` on success.  On broadcast failure,
@@ -752,10 +795,12 @@ impl WalletActor {
 
                 let node_client = self.node_client().await.ok().cloned();
 
-                let already_known = if let Some(client) = node_client {
-                    matches!(client.get_transaction(txid).await, Ok(Some(ref found)) if found.compute_txid() == txid)
-                } else {
-                    false
+                let already_known = match node_client {
+                    None => false,
+                    Some(client) => {
+                        let result = client.get_transaction(txid).await;
+                        matches!(result, Ok(Some(ref found)) if found.compute_txid() == txid)
+                    }
                 };
 
                 if already_known {

rust/src/manager/wallet_manager/payjoin.rs

@@ -136,6 +136,25 @@ impl PayjoinSessionPersister {
         };
         self.db.set_payjoin_sender_session(session)
     }
+
+    /// Returns the txid committed in the session's terminal marker, if any.
+    /// Used by the send gate to detect stale-cleanup state without a network call.
+    pub(crate) fn pending_txid(&self) -> Option<bitcoin::Txid> {
+        let session = self.db.get_payjoin_sender_session().ok()??;
+        match &session.pending_action {
+            None => None,
+            Some(PendingAction::BroadcastFallback) => {
+                consensus::deserialize::<BdkTransaction>(&session.fallback_tx)
+                    .ok()
+                    .map(|tx| tx.compute_txid())
+            }
+            Some(PendingAction::BroadcastProposal { transaction }) => {
+                consensus::deserialize::<BdkTransaction>(transaction)
+                    .ok()
+                    .map(|tx| tx.compute_txid())
+            }
+        }
+    }
 }
 
 impl SessionPersister for PayjoinSessionPersister {
@@ -704,7 +723,9 @@ pub(crate) fn resume_session(
         Ok(None) => return SessionResumption::None,
         Err(error) => {
             error!("failed to read payjoin session record: {error}");
-            return SessionResumption::None;
+            return SessionResumption::ReportError {
+                message: "could not read payjoin session; reopen the wallet to retry".to_string(),
+            };
         }
     };
 
@@ -764,16 +785,32 @@ pub(crate) fn resume_session(
     }
 }
 
-/// Recovers the fallback tx stored in the session record when replay is not possible
+/// Recovers the fallback tx from the session record when replay is not possible.
 fn fallback_from_record(db: &WalletDataDb, record: PayjoinSenderSession) -> SessionResumption {
     match consensus::deserialize(&record.fallback_tx) {
         Ok(fallback_tx) => SessionResumption::BroadcastFallback { fallback_tx },
+
+        Err(error)
+            if matches!(record.pending_action, Some(PendingAction::BroadcastFallback)) =>
+        {
+            // Marker was written before broadcast, so the fallback may have reached the node.
+            // Retain the record — we can't know the outcome.
+            error!("committed payjoin fallback tx is unreadable; retaining session record: {error}");
+            SessionResumption::ReportError {
+                message: "payjoin fallback data is unreadable — check your transaction history before retrying".to_string(),
+            }
+        }
+
         Err(error) => {
-            error!("stored payjoin fallback tx is corrupt, abandoning session: {error}");
-            if let Err(error) = db.delete_payjoin_sender_session() {
-                warn!("failed to clear corrupt payjoin session record: {error}");
+            // No terminal marker means the fallback was never dispatched; safe to clear.
+            error!("payjoin fallback tx is corrupt, clearing session: {error}");
+            if let Err(delete_error) = db.delete_payjoin_sender_session() {
+                warn!("failed to clear corrupt payjoin session record: {delete_error}");
+            }
+            SessionResumption::ReportError {
+                message: "saved payjoin recovery data was unreadable; the payment was not sent"
+                    .to_string(),
             }
-            SessionResumption::None
         }
     }
 }